>Number:         17856
>Category:       kern
>Synopsis:       bad checksum in response to a SSRR packet
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 06 06:14:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Mihai Chelaru
>Release:        NetBSD 1.6E
>Organization:
	
	RomTeleNet
>Environment:
	
	
System: NetBSD kefren.netbsd.ro 1.6E NetBSD 1.6E (Kefren) #2: Tue Aug 6 12:58:52 EEST 2002 mihai@kefren.netbsd.ro:/data/usr/src/sys/arch/i386/compile/Kefren i386
Architecture: i386
Machine: i386
Also tested on 1.5.2 and 1.6_BETA4 (all i386)
>Description:
	
	Response to an IP packet with SSRR option has bad checksum. I tried to send some packets from A to B (SYNs on B port 25, which is open). Those two machines are separated by machine C (cisco 3662). Here is an example grabbed with tcpdump running on host B:

	15:58:04.423953 A.63217 > B.smtp: S [tcp sum ok] 2968421977:2968421977(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0> (DF) (ttl 63, id 27786, len 68, optlen=8 SSRR{C#} NOP)
	15:58:04.424029 B.smtp > C.63217: S [bad tcp cksum 600!] 3870608620:3870608620(0) ack 2968421978 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0> (ttl 64, id 46008, len 68, optlen=8 NOP SSRR{#A})

>How-To-Repeat:
	
	See above.
>Fix:
	
>Release-Note:
>Audit-Trail:
>Unformatted: